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Amendment to Specification 



Please amend the paragraph starting at page 13, line 15 as follows: 

As shown in Fig. 1 1 , the symbol sequence, i.e., the sequence of message 
types, which is the starting point here, is known from the previously determined finite 
automaton. A window is then laid over the example communication, preferably of a 
width of w = 3 to 5. For this purpose, one must keep in mind that for detecting 
relationships between remote PDUs, larger windows are chosen; however, the larger 
a window size becomes, the smaller is the number of features derivable therefrom. 
In the example which follows, the message attributes of the first PDU are of type a 
are v and w, of the first PDU of type b is x and of the second PDU of type a are y 
and z, cf. Fig. 1 1 . 

Please amend the paragraph starting at page 15, line 5 as follows: 

For formulating the conditions, conspicuous accumulations of the values of a 
feature present in the training set or of a derived feature In a numerical value or 
within a numerical interval may be taken into consideration. Fig. 13 shows the accu- 
mulation of numerical values regarding a message attribute t. As shown, in an 
example communication t has the value 5 four times, the value 10 three times, the 
value 15 four times and the value 40 once. This gives rise to the assumption that 
there is an accumulation In the interval between 5 and 15. A conspicuous 
accumulation may be defined in particular in that it maximizes the quotient between 
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the width of the smaller one of the two gaps immediately adjacent the numerical 
interval in which there are no values of the feature in question, and the width of the 
largest gap within the numerical interval in which there are no values of the numerical 
interval in question. 



